solutions/guardrails-policies/05-data-location/template.yaml [15:56]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: datalocation
  annotations:
    description: Establish policies to restrict GC sensitive workloads to approved geographic locations.
    reference: https://github.com/canada-ca/cloud-guardrails/blob/master/EN/05_Data-Location.md
spec:
  crd:
    spec:
      names:
        kind: DataLocation
      validation:
        openAPIV3Schema:
          type: object
          properties:
            locations:
              description: List of allowed GCP Regions
              type: array
              items:
                type: string
            allowedServices:
              description: List of allowed GCP Services
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |-
        package datalocation
        violation[{"msg": message}] {
          asset := input.review.object
          not location_match(asset.spec.location, input.parameters.locations)
          not allowedResource(asset.kind, input.parameters.allowedServices)
          message := sprintf("Guardrail # 5: Resource %v ('%v') is located in '%v' when it is required to be in '%v'", [asset.kind, asset.metadata.name, asset.spec.location, input.parameters.locations])
        }
        location_match(str, pattern) {
          contains(str,pattern[_])
        }
        allowedResource(resource, allowed) {
          resource == allowed[_]
        }
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



